Documentation
¶
Overview ¶
Package sandbox limits filesystem effects of child commands.
Coverage is honest but partial by nature: Landlock does not mediate chmod, chown, xattr, utime, or fcntl metadata mutations, and old ABIs miss truncate. Enforcement is fail-closed: when the platform cannot sandbox, the wrapped command refuses to run (exit 126) with an actionable message instead of running unrestricted.
Index ¶
Constants ¶
const ( EnvMode = "ORB_SANDBOX_MODE" EnvRoot = "ORB_SANDBOX_ROOT" EnvCommand = "ORB_SANDBOX_CMD" EnvSelf = "ORB_SANDBOX_SELF" EnvShell = "ORB_SANDBOX_SHELL" )
Variables ¶
This section is empty.
Functions ¶
func SelfRestrict ¶
SelfRestrict installs a Landlock ruleset on the calling OS thread and its children. The caller must hold runtime.LockOSThread and exec immediately after: Landlock and no_new_privs bind to the thread, not the process.
func Wrap ¶
func Wrap(mode Mode, root, shell, command string, env map[string]string) (string, map[string]string)
Wrap replaces command without requoting it through the platform launcher. Both restrictive modes keep /dev and os.TempDir() writable so ordinary shell idioms (2>/dev/null, mktemp) work; workspace-write additionally opens root.
Source Files